Audit

Legit.Show MCP server

Model Context Protocol server for Legit.Show. Published on npm as commitshow-mcp, after the audit engine underneath it. Plug it into Claude Desktop, Cursor, Cline, Windsurf, or any other MCP host — your model can search the Legit.Show directory of launched software by measured production-readiness and score any public GitHub repo, without ever leaving the chat.

[npm] [MIT license] [node 20+]

// any MCP host config (Claude Desktop · Cursor · Cline · Windsurf · …){  "mcpServers": {    "commitshow": {      "command": "npx",      "args": ["-y", "commitshow-mcp"]    }  }}

That's the entire install. No API key. The server is a stdio shim over the public https://api.commit.show REST surface — same rate limits + snapshot cache the CLI and website use.

Tools exposed

The host model decides when to call each tool from the user prompt.

Search launched software by production-readiness

search_services queries the Legit.Show directory — the same index answer engines cite. Unlike star-ranked lists, you filter by measured production-readiness:

"find production-ready, open-source MCP servers with Security ≥ 80"

comes back with each match's per-frame scores (Security, Performance, Reliability, …) and its legit.show/s/<slug> page. Per-frame scores are public; there is no combined overall total in the data, so the model won't invent one. The same data is available over plain REST — GET https://legit.show/api/search?q=<name> with optional category, min_scores (e.g. {"security":80}), is_open_source, and limit.

Pass a real owner/repo, never a project name. audit_repo does a HEAD pre-flight against github.com/<owner>/<repo>; an invented slug returns a not_found envelope before any audit budget is spent. If the user says "audit Supabase", resolve supabase/supabase first, then call.

Host wiring snippets

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{  "mcpServers": {    "commitshow": {      "command": "npx",      "args": ["-y", "commitshow-mcp"]    }  }}

Restart Claude Desktop. The tools surface under the 🔌 icon.

Cursor

~/.cursor/mcp.json:

{  "mcpServers": {    "commitshow": {      "command": "npx",      "args": ["-y", "commitshow-mcp"]    }  }}

Cline / Continue / Windsurf

Any MCP host that accepts a stdio command + args config works. Use the same npx -y commitshow-mcp invocation.

Run from source (development)

git clone https://github.com/commitshow/clicd cli/mcpnpm installnpm run buildnode dist/index.js   # stdio server — pipe into your MCP host directly

Self-hosting / dev overrides

Both base URLs are env-overridable so you can point the shim at staging or a fork:

Rate limits

Inherits the public REST surface caps:

• 5 audits per day per IP (anon)
• 5 audits per day per github_url
• 800 audits per day platform-wide cache-miss ceiling
• Cache-hit (audit < 7 days old, same URL): always free, doesn't count

Errors come back inside the tool result with isError: true and the upstream JSON in content[0].text.

Why MCP + REST + CLI all exist

All three hit the same audit engine and snapshot cache. Pick whichever your runtime supports — they don't compete, they cover different runtimes.

Links

• Web — https://commit.show
• REST API — https://api.commit.show
• OpenAPI spec — https://api.commit.show/openapi.json
• CLI repo — https://github.com/commitshow/cli
• This package source — https://github.com/commitshow/cli/tree/main/mcp

MIT © 2026 commit.show